Four methods of program testing are
- Parallel simulation: actual client data through an auditor’s generalized audit software program
- Test Data: dummy transaction developed by auditor and processed by the client program to determine whether the controls which the auditor intends to test are operating effectively
- Integrated test facility introduces dummy transactions into a client’s system in the midst of live transaction
- Controlled reprocessing: process actual client data through a copy of the client’s application program.
Test data
Test data
- A set of dummy transactions is developed by the auditor and processed by the client’s computer programs to determine whether the controls which the auditor intends to test (not necessarily all controls) to restrict control risk are operating effectively. Some of these dummy transactions may include errors to test the effectiveness of programmed controls and to determine how transactions are handled (e.g., time tickets with invalid job numbers).
- When using test data, each control generally need only be tested once.
- when using test data, prepares a set of dummy transactions to determine if the controls purported to be in effect in a program are functioning as intended.
- Several possible problems include:
- (a) Making certain the test data is not included in the client’s accounting records.
- (b) Determining that the program tested is actually used by the client to process data.
- (c) Adequately developing test data for every possible control.
- (d) Developing adequate data to test key controls may be extremely time-consuming.
Parallel simulation
- Parallel simulation processes actual client data through an auditor’s generalized audit software program and frequently, although not necessarily, the auditor’s computer
- After processing the data the auditor compares the output obtained with output obtained from the client.
- The method verifies processing of actual transactions (as opposed to test data and ITF that use dummy transactions) and allows the auditor to verify actual client results.
- This method allows an auditor to simply test portions of the system to reduce the overall time and concentrate on key controls.
- Parallel simulation is likely to be more effective in an environment that does not involve continuous auditing
- The limitations of this method include:
- (a) The time it takes to build an exact duplicate of the client’s system
- (b) Incompatibility between auditor and client software
- (c) Tracing differences between the two sets of outputs to differences in the programs may be difficult
- (d) The time involved in processing large quantities of data
Integrated test facility
Integrated test facility introduces dummy transactions into a client’s system in the midst of live transaction
This method introduces dummy transactions into a system in the midst of live transactions and is usually built into the system during the original design. One way to accomplish this is to incorporate a simulated division or subsidiary into the accounting system with the sole purpose of running test data through it.
The test data approach is similar and therefore its limitations are also similar, although the test data approach does not run simultaneously through the live system. The running of dummy transactions in the midst of live transactions makes the task of keeping the two transaction types separate more difficult.
Controlled reprocessing:
Controlled reprocessing: process actual client data through a copy of the client’s application program.
Controlled reprocessing are likely to be more effective in an environment that does not involve continuous auditing
What are the benefits of Generalized Audit Software in an audit?
- Uses computer speed to quickly sort data and files- which leads to a more efficient audit
- Compatible with different client IT systems
- Extracts evidence from client databases
- Tests data without auditor needing to spend time learning the IT system in detail
- Client-tailored or commercially produced
What is the role of a Database Administrator?
- Maintains database
- Restricts access to authorized personel
- Responsible for IT internal control
- Authorization - ARC
What is the role of a Systems Analyst?
- Recommends changes and purchase of new system
- Design of new system
- Liaison between programming staff and user departments
- Authorization - ARC
What is the role of the data Librarian?
- Responsible for custody of the removable media
- Maintenance of program and system documentation
- Custody- ARC
What is a Data Definition Language?
A language that defines a database and gives information on database structure. It maintains tables- which can be joined together. It establishes database constraints.
What functions are performed by a Data Control Language?
A Data Control Language controls a database and restricts access to the database.
What functions are performed by a Data Manipulation Language?
- Maintains and queries a database, including updating, inserting in, modifying and querying (asking for data).
- Auditor needs information- so client uses DML to get the information needed
What are Check Digits?
A numerical character consistently added to a set of numbers.
It makes it more difficult for a fraudulent account to be set up or go undetected.
What is the purpose of a Code Review?
- A Code Review tests a program’s processing logic.
- Advantageous because auditor gains a greater understanding of the program.
- Difficulities becasue it is extremely time consuming - it requires a very high level of computer expertise, and difficulties involved with making certain that the program being verified is in fact the program in use throughout the accounting period.
What is the purpose of a Limit Test?
Examines data and looks for reasonableness using upper and lower limits to determine if data fits the correct range. Did anyone score higher than 100%?
What is the purpose of Transaction Tagging?
Transaction Tagging allows logging of company transactions and activities.
How can Embedded Audit Modules in software be utilized in an audit?
- Assist with audit calculations
- Enable continuous monitoring in an audit environment that is changing
- Weakness: requires implementation into the system design Example: SCARF - Collects information based on some criteria and can be analyzed at a later time (necessary because the audit environment is continually changing)
- Embedded audit modules are programmed routines incorporated into an application program that are designed to perform an audit function such as a calculation, or a logging activity. Because embedded audit modules require that the auditor be involved in systems design of the application to be monitored, this approach is often not practical.
- An audit hook is an exit point in an application program that allows an auditor to subsequently add an audit module (or particular instructions) by activating the hook to transfer control to an audit module.
What is an Audit Hook?
An Audit Hook is an application instruction that gives auditor control over the application.
How do Extended Records assist in audit trail creation?
Extended Records add audit data to financial records.
What is a Compiler?
Software that translates source program (similar to English) into a language that the computer can understand
-
Audit Reports49
-
Audit Sampling33
-
Engagement Planning63
-
Evidence and Risk77
-
Information Technology20
-
Internal Control26
-
International Auditing7
-
Professional Responsibilities37
-
SSARS19
-
Engagement Planning 123
-
Engagement Planning 222
-
Engagement Planning 323
-
Internal Control 115
-
Internal Control 214
-
Internal Control 315
-
Internal Control 413
-
Evidence and Risk 115
-
Evidence and Risk 215
-
Evidence and Risk 316
-
Evidence and Risk 417
-
Evidence and Risk 516
-
Audit Sampling 116
-
Audit Sampling 217
-
Audit Report 116
-
Audit Report 215
-
Audit Report 315
-
Audit Report 44
